Disable mod_security for QUERY_STRING (table_name) in specific file

Question

I host a site on a shared host which has mod_security turned on. The problem is, one of a third-party script gives 403 (access denied) when a query string contains: 'table_name'.

For example, this will trigger access denied:

http://www.example.com/blog/view.php?id=450&table_name=blogname

and this will work correctly (but it kills the script):

http://www.example.com/blog/view.php?id=450&test_name=blogname

So I tried to turn OFF mod_security for this 'table_name' query string from .htaccess but it doesn't work (I put this code into the root .htaccess, ie. /public_html/.htaccess):

RewriteEngine On
RewriteCond %{QUERY_STRING} ^.*(table_name).* [NC]
RewriteRule ^blog/view\.php$ - [E=MODSEC_ENABLE:Off]

Now I'm thinking this rule may be triggered only after security mode denied access to this query string? Is it possible to solve it?

Answer 1

I am unsure if I misunderstood your question. Are you the host, or are you hosting a site on a shared host?

If it is the second option, You can ask the host to disable mod_security on that url. I have had that issue in the past, and was solved just like that.

If it is the first, you can disable that yourself :)

Answer 2

You should be able to put this at the top off your .htaccess file to turn off mod security.

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>